CVE-2024-39930
CRITICAL 9.9EPSS 7.7%
The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected.
- CVSS v3.1
- 9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS v3.1
- 9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS v3.1
- 9.9 CRITICAL
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N - EPSS
- 7.74% chance of exploitation in the next 30 days, 94th percentile
- Published
- 2024-07-04
- Updated
- 2024-08-28
Proof-of-concept exploits (3)
- https://www.vicarius.io/vsociety/posts/argument-injection-in-gogs-ssh-server-cve-2024-399…
- alexander47777/-CVE-2024-399300★ · 2025-07-22
- theMcSam/CVE-2024-39930-PoC0★ · 2025-07-01